Privacy Policy

DrChQ helps you keep your own and your family's medical reports in one place. Health information is personal, so this policy explains in plain language what we collect, why, who helps us run the service, how long we keep it, and the rights you have. It applies to the DrChQ mobile app and the website at drchq.in (together, the "Service").

1. Information we collect

We collect only what the Service needs:

• Account information — your name, email address and profile photo from the Google account you sign in with.
• Health profile details — what you choose to enter for yourself and family members: name, relationship, date of birth, gender, blood group, height, weight, mobile number and emergency contact details.
• Medical reports — documents you upload or scan (PDFs and images such as prescriptions, lab reports, scans and visit summaries) and the details you add: report name, type, report date, doctor, hospital, clinic or lab, and notes. We also create a small preview image of each document so you can recognise it in the app.
• Your consent record — which version of our consent notice you accepted and when.
• Device and app information — a notification token for your device, your app version and platform, and basic technical logs (such as error messages and request times) needed to keep the Service secure and working.
• Deletion requests — if you use the request form on drchq.in, the email address and message you enter.
• Website analytics — only if you accept analytics cookies on drchq.in (see section 11).

We do not collect your contacts, location, call logs or any data from other apps. The camera is used only when you choose to scan a document.

2. Why we use it

We process your data on the basis of your consent, which you give in the app before adding health information, and only to:

• store, organise, show, search and let you download your reports and health details;
• keep your account secure and the Service working, including fixing errors and preventing misuse;
• send notifications related to your account and the app;
• respond to your requests and grievances;
• meet our obligations under Indian law.

We do not sell your data, use it for advertising or marketing profiles, or share it with anyone for their own purposes. We do not currently analyse your reports with artificial intelligence; if we offer such features in future, we will explain them and ask for your consent first.

3. Family members and children

You can add profiles for family members. When you do, you confirm that you have the consent of any adult you add, and that you are the parent or lawful guardian of any child under 18 you add. Under Indian law, a "child" is anyone under 18; a child's data is added and managed only by their parent or guardian through the guardian's own account. We do not knowingly allow anyone under 18 to create an account, and we do not track or profile children or show them advertising.

4. Who helps us run the Service

We use trusted service providers ("Data Processors") who process data only on our instructions and only to provide the Service:

• Google (Firebase Authentication) — signing you in with your Google account.
• Cloud hosting, database and file-storage providers — running our servers and securely storing your profile details, reports and document files.
• A push-notification service — delivering app notifications to your device.
• Website hosting provider — hosting drchq.in and receiving deletion requests submitted on it.
• Google Analytics — website usage statistics, only if you accept analytics cookies. It never receives your health data or reports.

We may also disclose data where required by Indian law, a court order or a lawful request from a government authority.

5. Where your data is stored

Your data is stored with reputable cloud providers on secure servers that may be located in India or in other countries. Wherever it is stored, it is protected as described in this policy, and any transfer outside India follows Indian law, including any restrictions the Government of India places on transfers to particular countries. We will update this section if the location of our main storage changes.

6. How we protect it

• All data between the app, the website and our servers travels over encrypted connections (TLS).
• Document files are kept in private cloud storage and can be opened only through short-lived links issued to your signed-in account.
• Every request to our servers is authenticated, and each account can reach only its own data. Family members' data stays inside the account that added it.
• Sign-in is handled by Google; DrChQ never sees or stores your password.
• Access to production systems is limited to what is needed to run the Service.

Our safeguards are modelled on the security practices of the US HIPAA Security Rule; this describes how we protect your data and is not a certification. No system is perfectly secure, so please keep your Google account and device protected.

7. How long we keep it

• While your account is active, we keep your reports and details so you can use them.
• When you delete a family member, their profile, reports, files and health details are erased immediately.
• When you delete your account, all of your data and your family members' data is erased immediately, including document files and your sign-in. Copies in encrypted backups, if any, are overwritten as those backups expire, within 30 days.
• We keep an anonymous deletion record — a one-way code that cannot identify you, the date and how many items were removed — as proof that erasure happened.
• Technical logs are kept only as long as needed for security and as required by law.

8. Your rights

You have the right to:

• Access — see your data in the app at any time, and ask us for a summary of the data we hold and the processing we carry out.
• Correction and updating — edit your profile, family members and reports directly in the app, or ask us to correct anything you can't.
• Erasure — delete family members, reports or your whole account in the app (Profile → Privacy & Security → Delete account), or request deletion at drchq.in/delete-account.
• Withdraw consent — at any time, as easily as you gave it. Because DrChQ cannot work without processing your health information, withdrawing consent means deleting your account; you can do this in the app or by writing to us. Withdrawal does not affect processing done before it.
• Nominate — name a person who can exercise these rights on your behalf if you die or become unable to. Email us with their details.
• Grievance redressal — complain to our Grievance Officer (section 9), and if you are not satisfied, to the Data Protection Board of India.

To exercise a right by email, write from the email address of your DrChQ account so we can confirm the request is yours.

9. Questions, complaints and data incidents

Questions or complaints about your data? Email our Grievance Officer at grievance@drchq.in — we aim to resolve them within 90 days, and you may also approach the Data Protection Board of India.

If a data breach affects you, we'll tell you what happened and what we're doing about it, as the law requires.

10. Your consent in the app

Before you add any health information, the app shows a short notice and asks you to confirm two statements: that you consent to DrChQ processing your health information, and that you have permission to add the family members you add. If we change this policy in a way that affects that consent, the app will ask you again.

11. Cookies and Website Analytics

We use two kinds of cookies and similar storage:

• Strictly necessary — storage required for the service to work, such as authentication session tokens that keep you signed in, and a record of your cookie choice. These are always on.
• Analytics (optional) — the DrChQ website uses Google Tag Manager and Google Analytics to understand how visitors use the site so we can improve it. Analytics cookies (such as _ga) are set only after you click "Accept" on the cookie banner. If you decline, no analytics cookies are set.

We do not use advertising cookies, and analytics is never used on your health data or medical records. You can change your choice at any time using the Cookie Settings link in the website footer. Google's use of this data is governed by the Google Privacy Policy.

12. Changes to this policy

We may update this policy as the Service changes. We will update the date at the bottom of this page, tell you about important changes in the app or by email, and ask for your consent again where the law requires it.

13. Laws that apply

This policy is written to meet India's Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000 and its rules on sensitive personal data. In the language of these laws, DrChQ is the Data Fiduciary for your data and you are the Data Principal.

14. Contact

DrChQ, India · hello@drchq.in

Last updated: 20 October 2026